402(a), 3(16), 3(38): A Business Owner’s Guide to 401(k) Fiduciary Roles

Over the past decade, high-profile 401(k) fee lawsuits and shifting DOL rules on investment advice have kept fiduciary responsibility in the headlines. Yet all that attention has done surprisingly little to help the business owners who sponsor these plans and carry ultimate responsibility.

Most owners are still confused by the alphabet soup of IRS Code sections defining the role of each provider - 402(a), 3(16), 3(21), 3(38) - unsure of the role of each, which roles may be delegated, and what liability remains on their plate afterwards. Choosing providers based on fiduciary status is not an academic question. Fiduciaries are held to one of the highest standards under the law, and getting it wrong can put your company’s and your personal assets on the line.

The natural response is to delegate as many roles as possible. But delegation carries its own risk; hand a role to the wrong provider — or one with hidden fees or conflicts — and you may shift the problem rather than solve it. One duty can never be delegated - prudently selecting those providers and monitoring them over time.

The good news is that this is far more manageable than it looks. Once you understand the basic hierarchy behind every 401(k) plan, what each role does, which ones are safe to delegate, and how to pick professionals you can easily monitor — ones with transparent fees, clearly defined roles, and no conflicts of interest — meeting your responsibilities becomes straightforward.

What is a 401(k) Fiduciary?

Being a 401(k) fiduciary is defined by what you do, not by a title. Under ERISA, you are a fiduciary to the extent you exercise discretion or control over how the plan is run, control its assets, or give investment advice for a fee.

As the business owner, you almost certainly qualify: hiring providers, choosing the investment menu, approving plan decisions, and even hiring a non-fiduciary financial intermediary are all fiduciary acts. Parties who merely carry out instructions without any discretion, by contrast, are performing purely ministerial tasks and generally are not fiduciaries.

A fiduciary is held to a demanding standard: act prudently and solely in participants’ interest. One who falls short can be held personally responsible for restoring participants’ losses. The good news is that limiting liability relies on process, not perfect outcomes if and when you delegate much of the work to professionals.

The 401(k) Fiduciary Hierarchy

Every 401(k) plan, whatever its size, runs on the same basic fiduciary hierarchy. The chart below maps it out. At the top is one party accountable for the whole plan, and beneath it are the three jobs every plan must cover: administering the plan, selecting and monitoring its investments, and holding its assets in trust.

Each role in the hierarchy is either a fiduciary, which carries legal responsibility and potential personal liability, or a ministerial one, which only carries out instructions and generally does not. The three jobs also differ in shape. Plan administration usually involves all of its roles at once, while investment selection and asset custody usually involve just one of the options shown. The sections that follow walk through each job in turn, covering what every role does, whether it is a fiduciary, and what stays on your plate if you delegate it.

Oversight: Who’s in Charge of the Plan

Someone has to sit at the top — appointing the plan’s other parties, monitoring them, and answering for the plan as a whole. Under ERISA §402(a), that party is the Named Fiduciary, designated in your plan document. In most plans it is the plan sponsor, typically the employer, acting through the 3(16) Plan Administrator; in a pooled employer plan (PEP), the role instead belongs to the pooled plan provider (PPP).

Like any role within the fiduciary hierarchy, it can be delegated to a professional (a PPP in the case of PEPs). But no delegation demands more vigilance: the named fiduciary's power to appoint and remove every other provider makes it the hardest of all to monitor.

Plan Administration: Running the Plan Day to Day

This is the machinery that keeps your plan running and compliant, the routine work to file the Form 5500, run annual nondiscrimination tests, approve distributions and loans, and track every participant’s account.

ERISA §3(16) Plan Administrator

The Plan Administrator is the person or entity named in the plan document. It defaults to the employer if none is named. This role is responsible for keeping the plan operating according to its terms and for any fiduciary duty the trustee has not assumed, which makes it the one clearly fiduciary role among the plan’s administrative parties.

Unknown to most small business owners, they are probably the 3(16) Plan Administrator. Your recordkeeper or TPA performs many administrative tasks for you, but that does not make them your 3(16) fiduciary. You can hire a professional 3(16) to formally take on the role and much of its liability but even then you keep the duty to prudently select and monitor the firm you hired.

Plan Recordkeeper

A recordkeeper tracks contributions, earnings, and investments at the participant level and directs the trustee or custodian to execute the trades participants request. A recordkeeper processes information without discretion, so it generally is not a plan fiduciary.

Third-Party Administrator (TPA)

A TPA handles annual ERISA compliance — nondiscrimination testing, the Form 5500, plan document maintenance, and preparing participant notices. Like a recordkeeper, a TPA is a non-fiduciary specialist you still choose and monitor as you would any vendor.

Investment Selection: Choosing and Monitoring the Investments

Every plan needs someone to build its investment lineup and monitor it. This role carries the largest share of potential liability. Imprudent investment decisions are the crux of most fee-related lawsuits. Three types of investment professionals are available for hire. The differences matter. Two are plan fiduciaries and one is not.

ERISA §3(38) Investment Manager

A 3(38) investment manager is a fiduciary that takes discretionary control of the plan’s investments — selecting, monitoring, and trading them itself rather than merely advising. To serve as a 3(38), a firm must be a bank, an insurance company, or a registered investment adviser, and it must acknowledge its fiduciary status in writing. Their scope varies, though. Some 3(38)s only build and monitor the plan’s fund menu, leaving participants to allocate among those funds, while others also make participant-level decisions through managed accounts or model portfolios.

This is where delegation carries the most weight: when you properly appoint a 3(38), ERISA §405(d)(1) shifts liability for the investment decision-making off you. To make your prudent selection and monitoring duty straightforward, you want to hire the right kind.

Look for one whose pay does not change with the investments it selects, with no revenue sharing or affiliated-product incentives; that states every dollar of its fees in writing; that favors prudent, low-cost investments and holds any complex or illiquid alternative to a demanding, participant-first standard; and that follows a documented process you could defend if you are ever questioned.

ERISA §3(21) Investment Advisor

A 3(21) investment advisor is a fiduciary who provides investment advice to the plan for a fee — recommending the investment lineup, for example, and advising on its ongoing monitoring. The operative word is advice. A 3(21) recommends; you, the employer, make the final call and keep fiduciary liability for it. Think of a 3(21) as a co-pilot: real expertise and a shared fiduciary standard, but you are still flying the plane.

Brokers, Insurance Agents, and other Salespeople

Not every professional who offers investment help is a plan fiduciary. The 401(k) market is full of brokers, insurance agents, and other salespeople who are not plan fiduciaries at all — they are held to lesser standards that tolerate conflicts of interest a fiduciary standard would not. Their compensation can shift with the products they sell, and they do not share your liability. They are not necessarily a bad choice, but they are a fundamentally different one: before you rely on anyone for investment help, confirm in writing whether they are serving as a 3(21) or 3(38) fiduciary.

Asset Custody: Holding the Assets in Trust

By law, 401(k) assets must be held in trust, kept separate from company money and protected for participants. Your plan document names a Trustee to hold them. In most plans that trustee is an individual at the sponsor — an owner or officer — unless the plan instead names a corporate trustee, such as a bank or trust company. What separates the trustee roles below is how much authority the trustee has over the assets.

ERISA §403(a) Trustee

A full §403(a) Trustee has discretionary authority to manage and control the plan’s assets — including investing them. That makes it a powerful, high-liability role. Appointing a 3(38) carves the investment decisions out of this trustee’s hands: the trustee keeps custody, and the 3(38) takes the investing.

ERISA §403(a)(1) Directed Trustee

A Directed Trustee holds the plan’s assets, but it has no discretion over them. It acts only on the direction of the Named Fiduciary or a 3(38). It is still a fiduciary, but with a much narrower mandate.

Custodian

Like a directed trustee, a custodian holds plan assets and exercises no discretion over them. The distinction is legal. A directed trustee holds the assets in trust and remains a fiduciary, bound to act only on proper directions, while a custodian simply provides safekeeping under a custodial agreement. Unlike a directed trustee, a custodian is typically not a fiduciary.

Monitoring: The Duty You Can’t Hand Off

You can hand off the work of almost every role, but never the responsibility to confirm each is being done prudently and for a reasonable fee. That is what regulators and courts actually judge you on — and it points to a practical rule that will protect you more than almost anything else: hire providers you can actually monitor.

A fiduciary’s best defense is a clear, documented process, and you can’t build one around services you can’t see or understand. Be wary of arrangements that are layered or deliberately opaque — bundled products that hide what each piece costs, revenue-sharing and other indirect compensation buried inside fund expenses, or a chain of affiliated parties where no one is clearly accountable. Complexity like that isn’t just annoying — it defeats the monitoring your protection depends on, and it often exists precisely because it profits the provider and is hard to question.

Favor the opposite: transparent, plainly stated fees, a clear description of who does what, and a provider willing to put its fiduciary status — or lack of it — in writing. The easier a provider is to monitor, the easier it is to show that you did — and the lower your exposure if something ever goes wrong.

The Hierarchy Roles Most Prone to Abuse

Not every delegation carries the same risk. Abuse potential climbs with a role’s control over the plan’s assets and with conflicts of interest, not with discretion alone. Hiring a qualified, conflict-free fiduciary and monitoring it is what keeps that risk from materializing.

The genuinely risky delegation is the one that offloads nothing: hand your investment help to a non-fiduciary broker or salesperson and you keep the full liability while inheriting their conflicts.

The table below shows what is at stake role by role, grouped by the four jobs — whether each role is a fiduciary, how much discretion it carries, and what a conflicted provider in that seat could do.

The Right Help Makes It Easy

Here’s the reassuring part: you don’t have to master all of this yourself. Once you can see the four jobs every plan must cover and who’s accountable for each, the path is simple. Delegate the roles that make sense to qualified, conflict-free professionals, and keep watching the ones you hand off.

The right provider makes that easy: transparent fees with no hidden revenue sharing, clearly defined roles, and no conflicts of interest give you a plan you can actually monitor — and the confidence that you’re meeting your responsibilities. Get that combination right, and the “alphabet soup” stops being intimidating.